title: “CVE-2024-21762 vs CISA KEV — Why a 10.0 CVSS CVE Doesn’t Always Beat a 5.3” date: 2026-10-21 description: “How CVSS, EPSS, and KEV combine into real prioritization — and why a 10.0 CVSS can sit unfixed longer than a 5.3.” tags: [“cve”, “kev”, “epss”, “risk-prioritization”] draft: false

CVE-2024-21762 vs CISA KEV — Why a 10.0 CVSS Doesn’t Always Beat a 5.3

TL;DR: CVSS measures exploitability, not likelihood. A 10.0 CVSS CVE without EPSS/KEV signal often gets fixed after 7.0 CVSS items. Real prioritization weights exploit evidence > raw CVSS.

The Paradox

CVE-2024-21762 (Ivanti Connect Secure) scored 10.0 CVSS v3.1 — the highest possible. Yet in the CISA KEV catalog it appeared with a due date, while many 9.x-10.x CVEs never made the list.

Why? CVSS and KEV answer different questions.

CVSS: How Easy Is It?

CVSS v3.1 Base Score measures exploitability:

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0
├─ Network-abusable: yes
├─ Low complexity: yes
├─ No auth required: yes
├─ No user interaction: yes
└─ Full impact: yes

That’s a capability score. If you can exploit it, here’s the damage. It does not answer “will someone exploit it?”

EPSS: How Likely Is Exploitation?

EPSS is a probability: “There is a X% chance this CVE is exploited in the wild in the next 30 days.”

A 1.2% EPSS means 98.8% chance it’s NOT exploited. High CVSS + low EPSS = theoretical, not urgent.

CISA KEV: Is It Already Being Used?

KEV is the strongest signal: a vendor PoC exists AND it’s observed in the wild. In the scoring model, KEV = 100 on that component — the maximum boost.

The Composite Model

A practical prioritization weights five factors:

Factor	Weight	What It Captures
CVSS (env/temporal)	25%	Exploitability
EPSS	20%	Exploitation probability
KEV	20%	Known in-the-wild
Asset criticality × exposure	20%	Business context
Exploit maturity	15%	PoC vs. commercial exploit

A 7.5 CVSS with 99th-percentile EPSS + KEV = ~95 priority. A 10.0 CVSS with 0.5% EPSS and no KEV = ~65. The lower CVSS wins.

What This Means for Triage

Don’t fix by CVSS alone. A 10.0 sits while 7.x items get patched.
EPSS > CVSS for ordering the backlog, everything equal.
KEV is a强制 (mandatory) accelerant. If in KEV, treat as critical regardless of base CVSS.
Context matters most. An external-facing critical asset amplifies everything.

The 10.0 isn’t unimportant — it’s a capability ceiling. Likelihood drives urgency.